Encoding Tools
Hash Generator (SHA-256, SHA-512)
Generate SHA-256 and SHA-512 hashes of text in your browser.
Input stays in this browser while you use the tool.
About this tool
The Hash Generator turns any text into a hash, also called a digest or a checksum, using the SHA-256 or SHA-512 algorithm. A hash is a short, fixed-length fingerprint of the input. The same text always gives the same hash, and the hash does not reveal the text it came from.
SHA-256 and SHA-512 belong to the SHA-2 family. A SHA-256 hash has 256 bits, which are written as 64 hexadecimal characters. A SHA-512 hash has 512 bits, written as 128 hexadecimal characters. The length never changes, whether the input is one letter or a whole book. The hash of the word hello with SHA-256 is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
Three properties make hashes useful. First, they are deterministic, so you can recompute a hash and compare it with an earlier one. Second, a tiny change in the input changes the hash completely: hello and Hello give hashes that differ in 125 of their 256 bits. Third, hashes are one-way, so there is no function that turns a hash back into the text. A short or common text can still be found by trying guesses, which is why hashes alone are not suitable for storing passwords.
A hash is not encryption. Nothing is hidden or locked, and there is no key to decrypt anything. The hash only identifies the exact input. The tool works on the text you enter, and the exact characters matter, including capital letters, spaces and line breaks. The hashing runs in your browser, so your text is processed on your own device and is not sent to the BitToolsKit server.
Use cases
- Check that a text has not changed. Compute the hash before and after a copy, an upload or an edit. If the two hashes are identical, the text is identical, down to the last space.
- Compare a value with a published checksum. Many projects publish a SHA-256 hash next to a download or a configuration value. Hash the text you have and compare the full string.
- Create a fingerprint or a cache key. A hash of a long text is a short, fixed-length identifier that is convenient as a key, a file name or an entry in a database.
- Find duplicates. Two texts with different hashes are certainly different, and two with the same hash are identical for all practical purposes.
- Debug your own code. Compare the result of your hashing function with a known correct value. If they differ, the cause is usually a newline, an encoding or a different algorithm.
- Test data and examples. Produce realistic hash values for documentation, mock records and unit tests.
- Learn how hashing behaves. Change one letter and watch the whole hash change, or hash the empty string to see that it also has a hash.
How to use
- Type or paste your text into the Input box. Enter exactly the text you want to hash, because every character counts.
- If the tool offers a choice of algorithm, select SHA-256 or SHA-512. Use the one that the other side expects. If you are not sure, SHA-256 is the most common.
- Click Run tool.
- Read the hash in the Output box. It is written in hexadecimal: 64 characters for SHA-256 and 128 for SHA-512.
- To compare with another hash, check the whole string. Hexadecimal is not case-sensitive, so
2CF2...and2cf2...are the same hash. - Click Copy output to copy the hash, Download to save it, or Clear to start again.
Be careful with invisible characters. A space or a line break at the end of the input gives a different hash, and the box will not always show you that one is there.
Examples
Example 1: SHA-256 of a word
Input: hello
SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 The hash has 64 hexadecimal characters, which are 32 bytes.
Example 2: One capital letter changes everything
Input: Hello
SHA-256: 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 Only the first letter changed, yet the hash differs from the hash of hello in 125 of 256 bits. It gives no hint that the two inputs were similar.
Example 3: The empty text
Input: (nothing)
SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Even an empty input has a hash. This value is the well-known SHA-256 hash of nothing.
Example 4: An invisible line break at the end
Input A: hello Input B: hello followed by a line break
SHA-256 of A: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 SHA-256 of B: 5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03 This is why the command echo hello piped to sha256sum shows the second hash: echo adds a line break. A line break written as carriage return plus line feed (Windows style) gives a third hash, cd2eca3535741f27a8ae40c31b0c41d4057a7a7b912b33b9aed86485d1c84676.
Example 5: SHA-512 of a sentence
Input: Hello, World!
SHA-512: 374d794a95cdcfd8b35993185fef9ba368f160d8daf432d08ba9f1ed1e5abe6cc69291e0fa2fe0006a52570ef18c19def4e617c33ce52ef0a6e5fbe318cb0387 The hash has 128 hexadecimal characters, which are 64 bytes.
Example 6: The same word in two encodings
Input: Café
SHA-256 of the UTF-8 bytes: 73473dcc12b763085904a5279d048c4d5b3b008c46f1f32443b99de04aa83a14 SHA-256 of the Latin-1 bytes: e134988854e6583f063fc0e9aefa55da3b20ab8d55413a6808f315789d73c1f5 Hashes work on bytes, not on letters. Text with accents gives different hashes in different encodings. Most modern systems use UTF-8.
Common errors
The hash is different from the one you expected
Look for invisible differences first. A trailing space, a line break at the end, a different line ending (CRLF instead of LF), a different capitalisation or a different encoding each produce a completely different hash. Hash the text exactly as the other side did.
A command-line tool gives another result than the text you pasted
Commands such as echo add a line break to the text. The result of echo hello piped to sha256sum is the hash of hello plus a line break, which is not the hash of hello. Use printf without a line break, or compare with the text that includes it.
The hash is the right length but not the expected value
Check the algorithm. SHA-256 and SHA-512 give different values for the same text. Their length tells you which is which: 64 hexadecimal characters is SHA-256 and 128 is SHA-512. A hash of 40 characters is SHA-1, and one of 32 characters is MD5.
Accented letters or other alphabets give another hash
The hash depends on the bytes of the text, so the encoding matters. Café has different bytes in UTF-8 and Latin-1. Make sure both sides use UTF-8.
Upper case and lower case hashes look different
Hexadecimal digits are not case-sensitive, so the hashes are identical. Compare them in the same case, or ignore the case when you compare.
Only a part of a hash was compared
Compare the complete hash. Matching the first few characters is not a reliable check, and a copy that was cut off is a common cause of a mismatch.
The tool was expected to hash a file
This tool hashes the text you enter, not a file. The hash of a file's name or of its text is not the hash of the file itself. To hash a file, use a command such as sha256sum, or a function from your programming language that reads the file bytes.
Trying to decrypt or reverse a hash
A hash cannot be reversed. A short or common text can only be found by trying guesses and comparing the results, which is a reason to use hashes with care for sensitive values.
Using plain SHA-256 or SHA-512 to store passwords
These algorithms are very fast, which helps an attacker. A plain Node.js script on one thread computes about 400,000 SHA-256 hashes per second, and specialised hardware is much faster. Store passwords with a slow, salted password hashing function such as Argon2, bcrypt, scrypt or PBKDF2.
A signature or a webhook check does not match
Many signatures are not plain hashes. They are HMACs, which mix a secret key into the hash. A plain hash of the message never matches an HMAC, whatever the algorithm. Use an HMAC function with the shared secret.
Frequently asked questions
What is a hash?
A hash is a fixed-length fingerprint that a hash function calculates from any input. The same input always gives the same hash, and a different input gives a different hash. The input cannot be read from the hash.
Is hashing the same as encryption?
No. Encryption is reversible with a key, while a hash cannot be reversed at all. Hashing is used to check and identify data, and encryption is used to keep data secret.
Can a hash be decrypted?
No. There is nothing to decrypt. People find the input behind a hash only by guessing candidates and comparing their hashes, which works for short, common or predictable texts.
What is the difference between SHA-256 and SHA-512?
Both belong to the SHA-2 family. SHA-256 produces 256 bits, shown as 64 hexadecimal characters, and SHA-512 produces 512 bits, shown as 128 characters. For most uses SHA-256 is enough, so choose the algorithm that your system or the checksum you compare with requires.
Are MD5 and SHA-1 still safe?
Not for security. Practical collision attacks exist for both, so they should not be used for signatures, certificates or integrity checks that an attacker could target. They are still used for simple checksums where no attacker is involved. For anything new, use SHA-256 or stronger.
Can two different texts have the same hash?
In theory yes, because there are more possible texts than hashes. For SHA-256 and SHA-512 nobody has found two different inputs with the same hash, and finding one is not practical.
Should I use SHA-256 to hash passwords?
No. Plain SHA-256 is designed to be fast, which makes guessing passwords fast too. Use a dedicated password hashing function such as Argon2, bcrypt, scrypt or PBKDF2, with a unique salt for every password.
What is HMAC?
HMAC is a way of using a hash function together with a secret key to prove that a message came from someone who knows the key and was not changed. It is used for API and webhook signatures. For the key key and the message message, HMAC-SHA256 gives 6e9ef29b75fffc5b7abae527d58fdadb2fe42e7219011976917343065f58ed4a.
Why is my hash different in another tool?
The inputs are not identical. The usual causes are a line break or space at the end, different line endings, a different encoding or a different algorithm. Compare the exact bytes that each tool hashed.
Is my text uploaded to a server?
No. The tool runs in your browser and works on your device. As a general habit, avoid pasting passwords, API keys or private tokens into any online tool.